Creating a Service Control Policy To Limit SSH Key Algorithms

ACM.384 Using an SCP with Conditions on the KeyPairType to restrict allowed algorithms when taking actions involving EC2 Key Pairs

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

⚙️ Check out my series on Automating Cybersecurity Metrics | Code.

🔒 Related Stories: AWS | EC2 OS Security | AWS Security | Encryption

💻 Free Content on Jobs in Cybersecurity | ✉️ Sign up for the Email List

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

In the last post I showed how to use CloudFormation to create an EC2 key pair — with some serious caveats.

In this post I’m going to explain how to create a Service Control Policy that restricts creation and use of EC2 KeyPairs to an approved algorithm.

To understand what we need to restrict and what is possible we need to take a look at the EC2 actions and condition keys.

The documentation has the condition keys we can use to restrict an action in the last column of the actions table:

If you look at the CreateKeyPair action you can see that it has KeyPairType in the last column, meaning you can create policies that restrict actions based on that value.

The documentation says that the CreateKeyPair action is for RSA keys but I presume that is also for keys that use other algorithms, since it includes the KeyPairType as a ConditionKey.

We used the KeyType in the last post where we were restricting use of an allowed algorithm in our CloudFormation template.

The key pair type can be set to one of two algorithms at the time of this writing:

Is that the same thing? I presume it is. I’m not sure what else it would be. But the documentation is not exactly clear on this point:

Would be nice if they listed acceptable values with condition keys where appropriate and aligned the names with the names in CloudFormation. #awswishlist

I showed you how to create Service Control Policies (SCP) in CloudFormation and how to apply them to your organization in many other posts so I’m not going to repeat all that here right now, as I have other things to get done.

Use the methods I already showed you to create an SCP in CloudFormation and add a condition on the CreateKeyPair action that limits users to using the ed25519 algorithm.

That algorithm is currently preferred over RSA due to the recent vulnerability described in this post.

However, if you are using Windows hosts, they require RSA at the time of this writing. You have a few options. You could put your Windows and Linux hosts in different accounts and apply the SCP to certain accounts or OUs. You could also try to craft a policy based on the type of EC2 instance that the user is deploying but that feels a bit more error prone to create and maintain.

The other thing to note is that there are a lot of other actions above that involve EC2 key pairs. You can restrict those actions as well but be aware that things might break. You might first test this in a sandbox environment. Then warn developers that they are going to be required to use only approved algorithms and give them a deadline to change their existing keys.

Also — help them find non-compliant resources! Create a report based on resources in your account and CloudTrail events to find people and resources who are still using non-compliant resources.

Once you’re certain all resources and users have switched over in your non-production environments, then tackle production — carefully. This is where it would be useful if AWS had a report only option for Service Control Policies that reported issues in a non-blocking manner. But since we don’t have that, you’ll have to create your own reports to see what’s out there before you roll out your SCP.

Back to what I was working on prior to this vulnerability report.

Follow for updates.

Teri Radichel | © 2nd Sight Lab 2023

About Teri Radichel:
~~~~~~~~~~~~~~~~~~~~
⭐️ Author: Cybersecurity Books
⭐️ Presentations: Presentations by Teri Radichel
⭐️ Recognition: SANS Award, AWS Security Hero, IANS Faculty
⭐️ Certifications: SANS ~ GSE 240
⭐️ Education: BA Business, Master of Software Engineering, Master of Infosec
⭐️ Company: Penetration Tests, Assessments, Phone Consulting ~ 2nd Sight Lab

Need Help With Cybersecurity, Cloud, or Application Security?
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
🔒 Request a penetration test or security assessment
🔒 Schedule a consulting call
🔒 Cybersecurity Speaker for Presentation

Follow for more stories like this:
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ 
❤️ Sign Up my Medium Email List
❤️ Twitter: @teriradichel
❤️ LinkedIn: https://www.linkedin.com/in/teriradichel
❤️ Mastodon: @teriradichel@infosec.exchange
❤️ Facebook: 2nd Sight Lab
❤️ YouTube: @2ndsightlab